Insider attack resistant system and method for cloud services integrity checking

Patent metadata

Field	Value
Publication number	US-9787701-B2
Application number	US-201715460818-A
Country	US
Kind code	B2
Filing date	Mar 16, 2017
Priority date	Aug 13, 2015
Publication date	Oct 10, 2017
Grant date	Oct 10, 2017

Abstract

An insider attack resistant system for providing cloud services integrity checking is disclosed. In particular, the system utilizes an automated integrity checking script and virtual machines to check the integrity of a service. The system may utilize the integrity checking script and virtual machines to execute a set of operations associated with the service so as to check the integrity of the service. When executing the set of operations, the system may only have access to the minimum level of access to peripherals that is required for each operation in the set of operations to be executed. After each operation is executed, the system may log each result for each operation, and analyze each result to determine if a failure exists for any of the operations. If a failure exists, the system may determine that a change in an expected system behavior associated with the service has occurred.

First claim

We claim:

1. A system, comprising:
a memory that stores instructions; and
a processor that executes the instructions to perform operations, the operations comprising:
executing, by utilizing a virtual machine executing a copy of a service and by utilizing an integrity checking script activated at the virtual machine, a set of operations associated with the service to check the integrity of the service, wherein the set of operations are executed based on a minimum level of access to a peripheral that is required for each operation in the set of operations to be executed, wherein the minimum level of access is established by suspending access to a network port;
executing, when the system is in a normal operation mode, the set of operations associated with service based on a full level of access to the peripheral and the network port;
logging each result for each operation in the set of operations after each operation is executed;
analyzing, by utilizing the virtual machine, each result for each operation in the set of operations to determine if a failure for an operation in the set of operations exists; and
determining, if the failure exists, that a change in a system behavior associated with the service has occurred.

2. The system of claim 1 , wherein the operations further comprise activating the integrity checking script.

3. The system of claim 2 , wherein the operations further comprise activating the integrity checking script at periodic intervals.

4. The system of claim 3 , wherein the operations further comprise performing an analysis on an integrity checking script when the integrity checking script is contaminated.

5. The system of claim 1 , wherein the operations further comprise mimicking a user by utilizing the virtual machine.

6. The system of claim 1 , wherein the operations further comprise determining if malware is affecting the service.

7. The system of claim 6 , wherein the operations further comprise removing the malware if the malware is determined to be affecting the service.

8. The system of claim 1 , wherein the operations further comprise generating an alert when the change in the system behavior associated with the service has occurred.

9. The system of claim 1 , wherein the operations further comprise enforcing the minimum level of access to the peripheral by synchronizing a software-defined network script with the integrity checking script.

10. The system of claim 1 , wherein the operations further comprise logging a number of times the peripheral is accessed during execution of the set of operations.

11. The system of claim 1 , wherein the operations further comprise suspending access to other peripherals.

12. The system of claim 1 , wherein the operations further comprise determining a manner in which malware affecting the service is perpetrating an attack on the service.

13. The system of claim 1 , wherein the operations further comprise enforcing the minimum level of access to the peripheral by utilizing a hypervisor layer firewall.

14. A method, comprising:
processing, by utilizing a virtual machine executing a copy of a service and by utilizing an integrity checking script executing at the virtual machine, a set of operations associated with the service to check the integrity of the service, wherein the set of operations are processed based on a minimum level of access to a peripheral that is required for each operation in the set of operations to be processed, wherein the minimum level of access is established by suspending access to a network port;
executing, when the system is in a normal operation mode, the set of operations associated with service based on a full level of access to the peripheral and the network port;
logging each result for each operation in the set of operations after each operation is executed or processed;
analyzing, by utilizing the virtual machine, each result for each operation in the set of operations to determine if a failure for an operation in the set of operations exists; and
determining, if the failure exists, a change in a system behavior associated with the service, wherein the determining is performed by utilizing instructions from a memory that are executed by a processor.

15. The method of claim 14 , further comprising generating an alert when the change in the system behavior associated with the service has occurred.

16. The method of claim 14 , further comprising determining if malware is affecting the service.

17. The method of claim 16 , further comprising determining a manner in which the malware is perpetrating an attack on the service.

18. The method of claim 14 , further comprising performing an analysis on an integrity checking script when the integrity checking script is contaminated.

19. The method of claim 14 , further comprising removing malware if the malware is determined to be affecting the service.

20. A computer-readable device comprising instructions, which when executed by a processor, cause the processor to perform operations comprising:
executing, by utilizing a virtual machine executing a copy of a service and by utilizing an integrity checking script activated at the virtual machine, a set of operations associated with the service to check the integrity of the service, wherein the set of operations are executed based on a minimum level of access to a peripheral that is required for each operation in the set of operations, wherein the minimum level of access is established by suspending access to a network port;
executing, when the system is in a normal operation mode, the set of operations associated with service based on a full level of access to the peripheral and the network port;
logging each result for each operation in the set of operations after each operation is executed;
evaluating, by utilizing the virtual machine, each result for each operation in the set of operations to determine if a failure for an operation in the set of operations exists; and
determining, if the failure exists, an occurrence of a change in a system behavior associated with the service.

Assignees

• At & T Ip I Lp

Inventors

• Jayawardena Thusitha
• Bickford Jeffrey E
• Istomin Mikhail
• Liefert John
• Singaraju Gokul
• Van Wart Christopher

Classifications

• G06F11/0712

  in a virtual computing platform, e.g. logically partitioned systems · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F11/0751

  Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06) · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F9/45512

  Command shells · CPC title